BSA/AML Examination Manual - ffiec

Third-Party Payment Processors — Overview
on-line gambling-related operations, and on-line payday lenders.) For example, a
processor whose customers are primarily offshore would be inherently riskier than a
processor whose customers are primarily restaurants.
• Determining whether the processor re-sells its services to a third party who may be
referred to as an “agent or provider of Independent Sales Organization (ISO)
opportunities” or “gateway” arrangements. 181
• Reviewing the processor’s policies, procedures, and processes to determine the
adequacy of its due diligence standards for new merchants.
• Identifying the processor’s major customers.
• Reviewing corporate documentation including independent reporting services and, if
applicable, documentation on principal owners.
• Visiting the processor’s business operations center.
Banks that provide account services should monitor their processor relationships for any
significant changes in the processor’s business strategies that may affect their risk profile.
Banks should periodically re-verify and update the businesses’ profiles to ensure the risk
assessment is appropriate.
In addition to adequate and effective account opening and due diligence procedures for
processor accounts, management should monitor these relationships for unusual and
suspicious activities. To effectively monitor these accounts, the bank should have an
understanding of the following processor information:
• Merchant base.
• Merchant activities.
• Average number of dollar volume and number of transactions.
• “Swiping” versus “keying” volume for credit card transactions.
• Charge-back history, including rates of return for ACH debit transactions and
remotely created checks.
181 Gateway arrangements are similar to an Internet service provider with excess computer storage capacity
who sells its capacity to a third party, who would then distribute computer service to various other
individuals unknown to the provider. The third party would be making decisions about who would be
receiving the service, although the provider would be providing the ultimate storage capacity. Thus, the
provider bears all of the risks while receiving a smaller profit.
FFIEC BSA/AML Examination Manual 210 8/24/2007